Yeah, if you just want to block access to direct pages, that's probably the best way to go without using something like a custom security package - otherwise, if you just want to make sure the pages are rendered correctly. You can actually just change your faces servlet mapping to .xhtml, which means that your source will not be exposed when people access pages.
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>*.faces</url-pattern>
</servlet-mapping>
If you want to do more complicated rewrite rules in order to actually lock down the pages, you could consider using a custom rewrite processor and implement the Processor interface.
http://ocpsoft.com/docs/prettyfaces/3.3.0/en-US/html_single/#inbound_rewriting.options
Custom processors have access to the HttpServletRequest and HttpServletResponse and invoke both on inbound and outbound rewrites: You can do more complicated things with this interface:
/**
* Perform a rewrite operation on a given URL, utilizing any necessary information from the given {@link RewriteRule}
* configuration object from which the processor was invoked.
*
* @author Lincoln Baxter, III <[email protected]>
*/
public interface Processor
{
/**
* Process an inbound URL Rewrite request. This takes place when the request first comes in to the server and passes
* through {@link RewriteFilter}
*/
String processInbound(HttpServletRequest request, HttpServletResponse response, RewriteRule rule, String url);
/**
* Process an outbound URL Rewrite request. This takes place when a URL is passed in to
* {@link HttpServletResponse#encodeRedirectURL(String)}, and since most frameworks ensure the call to
* 'encodeRedirectUrl()' occurs automatically, can be assumed to occur whenever a URL would be rendered to HTML
* output.
*/
String processOutbound(HttpServletRequest request, HttpServletResponse response, RewriteRule rule, String url);
}
Otherwise, what you are doing will work, and until OCPSoft Rewrite https://github.com/ocpsoft/rewrite ( Who are also behind PrettyFaces ) is released, in which case you could do this pretty easily with a simple inbound rewrite rule:
package com.example;
public class ExampleConfigurationProvider extends HttpConfigurationProvider
{
@Override
public int priority()
{
return 10;
}
@Override
public Configuration getConfiguration(final ServletContext context)
{
return ConfigurationBuilder.begin()
.defineRule()
.when(Direction.isInbound().and(DispatchType.isRequest()).and(Path.matches(".*\\.xhtml")).andNot(Path.matches(".*javax.faces.resource.*")))
.perform(SendStatus.code(404));
}
}
This Rewrite rule will block access to inbound HTTP requests on .XHTML files, while still allowing forwarded, or error, or async requests. It will also leave the JSF2 resources API in a functional state, which is not the case if you use the Java EE Security Constraint as suggested in another answer.
Hope this helps,
Lincoln
url-patternyou'll get a HTTP 403, no matter what filter you use. As a side note I use a security constraint based solution for this in a production environment, and so far I could not access JSF pages directly. – Puton